CVE-2026-92729

High

Description

SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and error activity without credentials.

SeverityHigh

CVSS8.2

Exploit probability—

ProductSignoz

PublishedSep 16, 2026

First seenSep 16, 2026

Weakness typeCWE-306Missing authentication for critical function CWE-862Missing authorization

How to fix

Update

SigNoz signoz0.141.1 or later

Patches

github.com/SigNoz/signoz/pull/12817
github.com/SigNoz/signoz/commit/f78bd492d8732f011bc96837cf9862db2df0783d

Vendor advisories

github.com/SigNoz/signoz/security/advisories/GHSA-v549-7j2x-qjm5
github.com/SigNoz/signoz/releases/tag/v0.141.1

Affected products

Product	Affected versions	Fixed in
SigNoz signoz	0.88.0 ≤ v < 0.141.1	0.141.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.